8b91ef040782575109e2fc5f7d794dc0d67d26980a0bb162cc184e3f2c26c5a6

Sharing

Copy URL Twitter E-mail

General

Target

8b91ef040782575109e2fc5f7d794dc0d67d26980a0bb162cc184e3f2c26c5a6
Size

2.7MB
MD5

a3a9c629bae0020f7dc80b6e85d79ec6
SHA1

ac1a5b03a9d497b94e38d9db645e5a87efed6268
SHA256

8b91ef040782575109e2fc5f7d794dc0d67d26980a0bb162cc184e3f2c26c5a6
SHA512

b616ff3b2e8de69e0670f8688141abc97a74a22520cd797a53e67bec1abbff8e05978df7bdf256f3f6d5f62689a65ab25370c8fbcf70ce1dfd4c0620450123ce
SSDEEP

49152:b2oh8doKrZmeR5B1qf5LVohWStiOtg01HTulXw:cZmenaVohWSsOtg0wG

Score

1^/10

Malware Config

Signatures

Files

8b91ef040782575109e2fc5f7d794dc0d67d26980a0bb162cc184e3f2c26c5a6
.exe windows:5 windows x86 arch:x86

4f4b4a6805c5b99531ec1a40e1069a26

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

05/01/2022, 09:58

Not After

06/01/2024, 09:58

Subject

SERIALNUMBER=911101026662879416,CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,STREET=朝阳区酒仙桥路6号院2号楼1至19层104号内8层801,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f8:c1:9b:f9:81:62:17:7b:5f:0a:aa:71:d9:32:7d:1f:31:40:e2:76:90:84:23:97:ff:29:40:b0:09:00:61:d1
Signer

Actual PE Digest

f8:c1:9b:f9:81:62:17:7b:5f:0a:aa:71:d9:32:7d:1f:31:40:e2:76:90:84:23:97:ff:29:40:b0:09:00:61:d1

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

getservbyname
ntohs
gethostbyaddr
ntohl
recvfrom
WSASetLastError
getservbyport
WSAIoctl
send
WSAGetLastError
connect
inet_ntoa
htons
closesocket
socket
ioctlsocket
inet_addr
htonl
getsockname
setsockopt
sendto
bind
gethostbyname
listen
accept
select
__WSAFDIsSet
getpeername
recv
WSAStartup

kernel32

FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
DeleteFileW
TerminateProcess
WriteFile
CreateFileA
WaitNamedPipeA
CreateNamedPipeA
GetStartupInfoA
GetOverlappedResult
WaitForMultipleObjects
ReadFile
CreateEventW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetFileSize
SetFileTime
CreateFileW
MoveFileW
CreateDirectoryW
SetEvent
GlobalSize
GetFileAttributesW
GetTempPathA
ResetEvent
WaitForSingleObject
TerminateThread
SetThreadPriority
CreateThread
GetLocalTime
OutputDebugStringA
WideCharToMultiByte
GetSystemTimeAsFileTime
DeviceIoControl
FindFirstFileA
FindNextFileA
GetDriveTypeW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemInfo
GetSystemDirectoryA
CreateToolhelp32Snapshot
TryEnterCriticalSection
InterlockedExchangeAdd
InterlockedCompareExchange
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetTimeZoneInformation
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
VirtualQuery
VirtualProtect
HeapReAlloc
ExitProcess
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
InterlockedExchange
DeleteFileA
OpenProcess
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
SetFilePointer
GetFullPathNameA
GetCurrentDirectoryA
GetModuleHandleA
FreeEnvironmentStringsW
Process32FirstW
Process32NextW
LoadLibraryW
ProcessIdToSessionId
GetVersionExW
CreateProcessA
VerSetConditionMask
VerifyVersionInfoW
CreateFileMappingW
GetProcAddress
lstrcmpiW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
InitializeCriticalSection
lstrlenW
GetModuleFileNameW
GetModuleHandleW
GetCPInfo
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
Sleep
CreateMutexW
CloseHandle
GetLastError
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
RaiseException
GetCurrentThreadId
SetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetEnvironmentStringsW
GetCommandLineW
LCMapStringA
LCMapStringW
FlushFileBuffers
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
GetStdHandle
LocalAlloc
LoadLibraryA

user32

EnumWindows
WindowFromPoint
UnregisterClassW
RegisterClassW
SendInput
UnregisterHotKey
GetDesktopWindow
SetLayeredWindowAttributes
RegisterHotKey
GetClipboardData
GetPriorityClipboardFormat
GetClipboardSequenceNumber
ExitWindowsEx
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetThreadDesktop
FindWindowW
GetDlgItemTextW
GetDlgItemInt
SetDlgItemTextW
SetDlgItemInt
SendDlgItemMessageW
SetScrollInfo
ShowScrollBar
GetScrollInfo
ClientToScreen
DrawTextA
FillRect
EnableWindow
SetScrollPos
GetScrollRange
GetScrollPos
GetWindowThreadProcessId
CallWindowProcW
MonitorFromPoint
CheckMenuItem
EnumDisplaySettingsW
EnableMenuItem
DeleteMenu
LoadMenuW
DialogBoxParamW
GetDlgCtrlID
GetActiveWindow
SetFocus
GetCursorPos
DrawTextW
GetWindowTextLengthW
GetKeyState
CreatePopupMenu
AppendMenuW
TrackPopupMenu
DestroyMenu
SetCapture
GetCapture
PtInRect
SetCursor
ReleaseCapture
SystemParametersInfoW
ChangeDisplaySettingsW
SetForegroundWindow
IsWindow
EndPaint
BeginPaint
DestroyIcon
IsWindowVisible
OffsetRect
LoadIconW
DrawIconEx
UnionRect
mouse_event
OpenInputDesktop
IntersectRect
GetUserObjectInformationW
MoveWindow
EnumDisplayMonitors
KillTimer
LoadImageW
GetParent
GetWindow
GetWindowRect
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetIconInfo
GetCursorInfo
BlockInput
GetSubMenu
MapVirtualKeyW
MapWindowPoints
SendMessageW
SetTimer
SetWindowTextW
GetSystemMetrics
IsDialogMessageW
GetDC
ReleaseDC
CharNextW
RegisterClassExW
LoadCursorW
GetClassInfoExW
CreateWindowExW
MessageBoxW
DefWindowProcW
PeekMessageW
SetWindowLongW
EndDialog
DestroyWindow
CreateDialogParamW
LoadStringW
LockWorkStation
GetDlgItem
GetDlgItemTextA
GetClientRect
SetWindowPos
ShowWindow
InvalidateRect
UpdateWindow
PostMessageW
OpenDesktopW
SetThreadDesktop
CloseDesktop
GetMessageW
PostQuitMessage
TranslateMessage
DispatchMessageW
PostThreadMessageW
UnregisterClassA
GetWindowTextW

gdi32

CreateDCW
BitBlt
RestoreDC
GetPaletteEntries
ExtSelectClipRgn
CreateRectRgn
StretchBlt
CreateCompatibleDC
CreateDIBSection
SetStretchBltMode
GetObjectW
GetDIBits
GetTextExtentExPointW
CreateHatchBrush
CreateFontW
ExtTextOutW
RoundRect
Polygon
Ellipse
ExcludeClipRect
SelectClipRgn
SetViewportOrgEx
SetBkColor
CreatePen
GetStockObject
GetDeviceCaps
DeleteObject
CreateSolidBrush
Rectangle
SelectObject
DeleteDC
PatBlt
SetTextColor
SaveDC
TextOutW
SetBkMode

advapi32

LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
DeleteService
CreateServiceW
OpenServiceW
StartServiceW
ControlService
ChangeServiceConfig2W
OpenSCManagerW
CloseServiceHandle
RegQueryValueExW
GetUserNameW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
CreateProcessAsUserA

shell32

SHGetFolderPathW
DragFinish
Shell_NotifyIconW
DragAcceptFiles
ShellExecuteA
DragQueryFileW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeEx
CoUninitialize
PropVariantClear
CoCreateInstance

oleaut32

VariantClear
VarUI4FromStr
VariantInit

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 530KB - Virtual size: 529KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f4b4a6805c5b99531ec1a40e1069a26

Code Sign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0bCertificate

Extended Key Usages

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

f8:c1:9b:f9:81:62:17:7b:5f:0a:aa:71:d9:32:7d:1f:31:40:e2:76:90:84:23:97:ff:29:40:b0:09:00:61:d1Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

userenv

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rodata Size: 512B - Virtual size: 24B

.rdata Size: 530KB - Virtual size: 529KB

.data Size: 28KB - Virtual size: 42KB

.rsrc Size: 27KB - Virtual size: 27KB

.reloc Size: 71KB - Virtual size: 70KB

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

44:8a:bf:29:b0:45:82:3e:5d:6d:cc:0b
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

f8:c1:9b:f9:81:62:17:7b:5f:0a:aa:71:d9:32:7d:1f:31:40:e2:76:90:84:23:97:ff:29:40:b0:09:00:61:d1
Signer

.text
Size: 2.1MB - Virtual size: 2.1MB

.rodata
Size: 512B - Virtual size: 24B

.rdata
Size: 530KB - Virtual size: 529KB

.data
Size: 28KB - Virtual size: 42KB

.rsrc
Size: 27KB - Virtual size: 27KB

.reloc
Size: 71KB - Virtual size: 70KB